CVE-2022-31014

SMTP Command Injection in iCalendar Attachments to emails via newlines in Nextcloud Server

Severity Score

3.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Nextcloud server is an open source personal cloud server. Affected versions were found to be vulnerable to SMTP command injection. The impact varies based on which commands are supported by the backend SMTP server. However, the main risk here is that the attacker can then hijack an already-authenticated SMTP session and run arbitrary SMTP commands as the email user, such as sending emails to other users, changing the FROM user, and so on. As before, this depends on the configuration of the server itself, but newlines should be sanitized to mitigate such arbitrary SMTP command injection. It is recommended that the Nextcloud Server is upgraded to 22.2.8 , 23.0.5 or 24.0.1. There are no known workarounds for this issue.

El servidor Nextcloud es un servidor de nube personal de código abierto. Se detectó que las versiones afectadas eran vulnerables a la inyección de comandos SMTP. El impacto varía según los comandos admitidos por el servidor SMTP de back-end. Sin embargo, el principal riesgo aquí es que el atacante puede secuestrar una sesión SMTP ya autenticada y ejecutar comandos SMTP arbitrarios como usuario de correo electrónico, como enviar correos electrónicos a otros usuarios, cambiar el usuario FROM, etc. Como antes, esto depende de la configuración del servidor en sí, pero las nuevas líneas deben ser saneadas para mitigar la inyección de comandos SMTP arbitrarios. Se recomienda que el servidor Nextcloud se actualice a versiones 22.2.8, 23.0.5 o 24.0.1. No se conocen mitigaciones adicionales para este problema

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-18 CVE Reserved
2022-07-05 CVE Published
2024-01-26 EPSS Updated
2024-08-03 CVE Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-264h-3v4w-6xh2	2024-08-03
https://hackerone.com/reports/1516377	2024-08-03

URL	Date	SRC
https://github.com/nextcloud/server/pull/32428	2023-06-29

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				< 19.0.13.7 Search vendor "Nextcloud" for product "Nextcloud Server" and version " < 19.0.13.7"		enterprise		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				< 22.2.8 Search vendor "Nextcloud" for product "Nextcloud Server" and version " < 22.2.8"		-		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				>= 20.0.0 < 20.0.14.6 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 20.0.0 < 20.0.14.6"		enterprise		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				>= 21.0.0 < 21.0.9.5 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 21.0.0 < 21.0.9.5"		enterprise		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				>= 23.0.0 < 23.0.5 Search vendor "Nextcloud" for product "Nextcloud Server" and version " >= 23.0.0 < 23.0.5"		-		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				24.0.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version "24.0.0"		-		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				24.0.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version "24.0.0"		beta1		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				24.0.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version "24.0.0"		beta2		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				24.0.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version "24.0.0"		beta3		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				24.0.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version "24.0.0"		rc1		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				24.0.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version "24.0.0"		rc2		Affected
Nextcloud Search vendor "Nextcloud"		Nextcloud Server Search vendor "Nextcloud" for product "Nextcloud Server"				24.0.0 Search vendor "Nextcloud" for product "Nextcloud Server" and version "24.0.0"		rc3		Affected